Error: Failed to log in with VCF SSO service - LDAP Bind Timeout - VCF Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article outlines the troubleshooting steps to resolve authentication failures in VMware Cloud Foundation (VCF) Operations when using VCF SSO, specifically where errors indicate a failure to log in with the VCF SSO service due to LDAP bind timeouts.

Environment

• VMware Cloud Foundation (VCF) 9.0.2
• VCF Operations (Aria Operations)
• VCF Identity Broker
• Active Directory/LDAP

Cause

Authentication failures occur when Active Directory/LDAP Domain Controllers take longer than the maximum allowed 5 seconds to process LDAP bind requests. This typically happens when Domain Controllers are overloaded or when service accounts (e.g., Avamar, VCF Automation) perform excessive, uncached authentication requests, saturating the AD bind queue.

Resolution

1. Analyze Logs: Review analytics-*.log and vIDB logs for VidbClientException or HTTP 401 errors, and correlate timestamps with LDAP bind response delays.
2. Execute Bind Test: Use the ldap_bind_test.sh diagnostic script to measure bind response times from the VCF Operations appliance.
   • Example: chmod +x ldap_bind_test.sh
   • Usage: ./ldap_bind_test.sh "CN=[User_DN]"
3. Engage AD/LDAP Team: Request that the internal AD team review Domain Controller tracing and performance to identify the source of bind latency.
4. Remediate Service Accounts: Configure service accounts (e.g., Avamar, svc-vcf-sso) to cache and reuse authentication tokens for the full duration of their 4-hour Time-to-Live (TTL). Avoid requesting new logins on every operation.

Additional Information

• For instructions on how to retrieve log bundles, refer to the VCF documentation.
• If the issue persists, contact Broadcom Support: Contact Broadcom Support.